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Ms Elizabeth Denham 

Information Commissioner 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 


Dear Ms Denham 
ICO Consultation on the draft updated data sharing code of practice 


The British Insurance Brokers' Association (BIBA) is the UK's leading general insurance intermediary 
organisation representing the interests of insurance brokers, intermediaries and their customers. 


BIBA membership includes just under 2,000 regulated firms, employing more than 100,000 staff. 


General insurance brokers contribute 1% of GDP to the UK economy; they arrange 70% of all general 
insurance with a premium totalling £62.4bn and 87% of all commercial insurance business. Insurance 
brokers put their customers’ interests first, providing advice, access to suitable insurance protection and 
risk management. 


BIBA receives more than 600,000 enquiries per year to its Find Insurance services, online and via the 
telephone which are directed to member insurance broking firms. 


BIBA is the voice of the sector advising members, the regulators, consumer bodies and other stakeholders 
on key insurance issues. 
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Association Find-A-Broker Service: 0370 950 1790 Association is a Limited Company 
8th Floor, John Stow House Registered in England No. 

18 Bevis Marks Facsimile: 020 7626 9676 1293232 
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BIBA welcomes the opportunity to respond to the ICO’s consultation on the draft updated data sharing 
code of practice as we recognise the important benefits that data sharing can bring to organisations and 
individuals alike. We are responding on behalf of our members who arrange policies of insurance for their 
clients, both individuals and commercial entities, and where possible, support those clients in the 
settlement of their claims by insurers when they arise. 


BIBA applauds the ICO’s sentiments behind producing the guidance but as a sector that shares ordinary 
personal data and special categories of data (as permitted under Part 2 of Schedule 1 of the Data 
Protection Act 2018), we feel that it would be more helpful to have industry specific guidance with case 
studies or data sharing scenarios more relevant to the general insurance intermediary sector. 


It is important to highlight that 57% of BIBA’s member firms have five or fewer staff and thus do not have 
the resources or the financial means to obtain legal support from a law firm as the ICO’s guidance on page 
60 suggests that larger firms will do. 


By way of an example of where industry-specific guidance would be welcome; on page 53 of the guidance, 
the ICO states that if a data sharing arrangement involves any automated decision making (ADM), then the 
firm must document the specific lawful basis for that ADM in their data protection policy. As 
intermediaries, BIBA members would welcome additional guidance about how the ICO would expect them 
to document this ADM where the ADM takes place within the realms of the other data controller (an 
insurer) with whom the data is being shared. It may be the case that one or more insurers with whom data 
is shared for the purpose of obtaining insurance cover for the customer, could offer products that are 
based on an ADM, as well as products that do not. 


We would be happy to discuss any of our points further if this would assist. 


Yours sincerely 


